I’ve said it for a few years now, but host-based antivirus is really not working anymore. Not with its focus on enumerating bad code and its reliance on signatures to detect malware.

Recently, several prominent antivirus vendors have experienced problems with faulty virus definitions: Faulty McAfee update burns IT execs; BitDefender update breaks 64-bit Windows PCs; [Clamav-announce] problem with daily.cvd 10938; 100% CPU usage with VIPRE definitions 6272 – 6274.

Although all of these vendors have promised the obvious improvements to their QA and testing processes, there is no sign that these problems will diminish over time. Instead, it is pretty clear that there will be more problems as the massive increase of malware is forcing vendors to push out updates faster and faster.

There are several problems with malware protection which relies on signatures:

1. Malware writers are using sophisticated toolkits which reduce the skill and time needed to produce effective malware.

2. Polymorphic malware regularly gets around signature detection, forcing AV vendors to constantly push out new signatures – several times per day!

3. There are many kinds of malware that are still not properly detected by up-to-date AV solutions with current definitions.

Where does this leave us?  Host-based antivirus products are using up more CPU cycles to process an ever-growing list of viruses, yet are still unable to keep up with the onslaught of new malware. To make matters worse, the constant creation and release of new defnition flies is stressing the quality assurance (QA) process for antivirus vendors. We have reached the place where IT professionals are considering turning off automatic AV updates, and deploying labs to test the updates before release.

In short, the odd of timely detection continues to drift downward ever so slowly, while the risk of friendly fire from the AV solution itself creeps upward ever so steadily.  We are long overdue for a different approach.

Application whitelisting
Companies such as Bit9, CoreTrace, and Lumension have been pushing application whitelisting for years now.  Microsoft has also provided this technology via AppLocker in Vista, Windows 7 and Server 2008. Even some of the major AV players have purchased or developed application white listing technology, but they have not been actively pushing it into the mainstream.  
They need to start.

Better yet, we as IT leaders and professionals need to start evaluating and deploying the technologies that better address information security concerns in 2010 and beyond, allowing us to make better use our limited budgets and resources.

Application white listing is a good idea, because for every environment, there are less items that fall into the “known good” category than bad code that you don’t want to run.  Just consider the difference in a firewall rule-set that assumes a "deny all that has not been explicitly opened" stance versus one that tries to explicitly prevent access to all bad protocols and ports.  

The frequency of change in the “allow list”, particularly in corporate environments, will be greatly reduced as compared to the “bad list”.  This automatically minimizes the chance for error.   It also means that less processing power will be needed.

Mitigating code-enabled data
I think that we really have to weigh the disadvantage of code-enabled data files and either abandon them outright, or at least ensure that there are centrally controlled configuration options for enabling or disabling the automation features of productivity applications.

For instance, consider how diminished the threat of macro-embedded documents has become since Microsoft enabled much better controls over macro security, including turning them off by default, and allowing them to be set via policies.  We need to do the same for PDF exploits.

Getting a better handle on security at the host level entails not only controlling which application can run, but determining in what context, and with what functionality it can run at any given time.  If we can get vendors to provide us with centralised controls regulating all of the features they integrate into their apps, then each person and each organisation can determine what level of risk to assume for any given application.

All of these options will sufficiently mitigate external risks without simultaneously increasing risks from errors.  And they will consume less processing power and generate less application conflicts than our current antimalware solutions.

Using the right technology
Signature-based security devices still have their place within the enterprise – mostly at the perimeter.  (And even there, their days are numbered.)  But at the desktop, they are increasingly causing more pain than gain, and it is time for us to change our approach, lest we find ourselves slipping further and further behind the malware writers.

And white listing need not concern itself with every executable.  Each organisation can determine just how much to watch and keep track of, balancing performance, productivity and security according to a risk profile that they select.

Yes, there will be a few challenges to address in order to see mainstream use of white listing technology – including the integration of such technology into the patch management process – but, the gains will be well worth it.  Environments that have moved in this direction are already seeing significant ROI just in terms of recovering lost administrator time from managing the AV process and from recovering from broken antivirus definitions.

Those who get ahead of the curve in the next 9-15 months will save themselves and their organisations significantly vs those who keep using the same old methods, even as the nature and intensity of the threat landscape has changed dramatically.

Blacklisting is out. White listing is in. Please get with the programme.